For requests under sections 13 to 16 and 18 the controller must tell the data subject in writing, without undue delay and within one month of receipt, whether the request is granted or refused with reasons (unless law forbids giving them); for stated reasons the period may be extended by up to two months, to a maximum of three months from receipt, provided the person is told before the first month ends; and the controller must tell the person of the right to appeal a refusal to the Authority. The 2025 Act replaced the earlier 21-working-day limit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.